Ossec HIDS 

The OSSEC Host Based Intrusion Detection System provides a very powerful and flexible event and syslog analysis.

A very comprehensive installation and configuration guide has been written by Secquard and there is little point covering the same ground again, the PDF paper can be found at,
www.ossec.net/ossec-docs/ossec_inst_secquard_nl.pdf
if it is not held locally.

One area the paper does gloss over is that of cutting and pasting the Key for the agents. It assumes a good knowledge of Unix tools or that the Server has X-Windows running. This is not the case with the IDS system this paper details and so a guide to using the screen window manager application is included here. Screen can be used from the console of over a remote session (ssh).

At the shell prompt type screen, you will be presented with a page of text, just press Enter or the Space Bar and you will see the prompt as usual.

All commands in screen are prefixed with the Control Key and shown here as CTRL-a meaning hold the 'Control' key and press the 'A' key.

To create a new window, and be placed inside of it, type "CTRL-a c". (Hold down the control key and typing a, then type c for "create.") Now you have two virutal windows, and you are in the second one you created. 
To navigate back to the first window, type "CTRL-a spacebar." Type it again, and you return to the second window. CTRL-a spacebar pages through the open windows.
Navigate to the first window CTRL-a spacebar or CTRL-a 0 (zero)
and change into the /var/ossec/bin directory. Now do the same in the second window.
#cd /var/ossec/bin

Run the Ossec manage_agents script as instructed in the Secquard paper and when you need to copy the key do the following.

Extract the Key as instructed and when the Key is displayed on screen press CTRL-a ESC, now move the cursor (using the Arrow keys) over the start of the text you want to copy and press the Space-bar. Move the cursor down to the bottom of the text block and press the Space-bar again. This copies the text into a buffer.
Now change windows (CTRL-a Space-bar) and open a text file vi key001 and enter input more (i) or open the file with ee, 
#ee key001
Now paste the text, CTRL-a ] and the text block should be pasted in to the file.
Write and Save the file.
Now you can repeat this for each agent key you need to generate.

The other area which the Secquard paper is weak on is the issue of transferring the agent keys on to a Microsoft Windows system. The FreeBSD IDS server has SSH (SCP) and FTP clients but no SMB client. 
The easiest way to transfer the agent key file is probably by copying the files over to the web server directory and using IE on the Windows Server to retrieve them.
The Web Server Root directory is
/usr/local/etc/lws/docroot
Remember to remove the agent key files when you have transferred them over. Use the rm command (with the -i switch  for interactive) as follows
#cd /usr/local/etc/lws/docroot
#rm -i key001 key002
press the Y key to confirm or any other key to not remove the listed file.

Note: Under Internet Explorer 7, the LWS certificate will cause IE to stop loading the site with an error message which indicates a network connectivity issue. Open the Tools - Internet Options - Advanced and scroll to the bottom of the option list. Check the Turn off Automatic Website Checking and Use SSL 2.0 The site should now load.

Once the Ossec Server has been configured you need to ensure that Ossec starts when the Server reboots. Add this to the local root crontab (make sure you are logged in as the Root user),
#crontab -e
@reboot /var/ossec/bin/ossec-control start

Now edit the system crontab (/etc/crontab) and add this line to the bottom of the file,
*/20	*	*	*	*	root 	/root/oss2html.sh

Make sure you are in the Root directory (/root) and unpack the Ossec convertion script,
#tar xvf ./oss2html.tar

Every 20 minutes, the Ossec report file (var/osses/logs/alerts/YEAR/MONTH/file) will be available in HTML format via the HTTPS server as https://server/ossec.html or loaclly as
#lynx http://127.0.0.1/ossec.html
This file gets appended to over the course of 24 hours and a new file produced at midnight.

ChrisB chrisb@bsduser.co.uk